attack.t1562.006 | Detection.FYI

Auditing Configuration Changes on Linux Host

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detect changes in auditd configuration files

Read More
Disable of ETW Trace - Powershell

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Read More
ETW Trace Evasion Activity

Aug 12, 2024 · attack.defense-evasion attack.t1070 attack.t1562.006 car.2016-04-002 ·
Share on:

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

Read More
Logging Configuration Changes on Linux Host

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detect changes of syslog daemons configuration files

Read More
Okta User Session Start Via An Anonymising Proxy Service

Aug 12, 2024 · attack.defense-evasion attack.t1562.006 ·
Share on:

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

Read More